A bunch of junk software becomes a stumbling block to start Windows XP ~
EndurerOriginal1st-
A netizen, the computer originally had Kingsoft drug overlord, and unfortunately won the bid. The installation of Kabbah 6 was swept out, but it was still very slow when Windows was started. Let me help with the repair.
Pe_xscan is used to scan logs and analyze the logs. The following suspicious items are found:/---Pe_xscan 07-06-23 by Purple endurerWindows XP Service Pack 2 (5.1.2600)Administrator user
After you enter the password to log on to the system, the system will automatically log out again? It turned out to be a fault caused by a bot.
EndurerOriginal2008-02-15 1st
A netizen opened a passionate webpage connection due to curiosity and unfortunately won the bid. After scanning and killing viruses with rising, the system automatically logs out after you enter your account and password to log on to the system. The reason for this situation is that the windows system file userinit.exe is in
EndurerOriginal
2006-12-232Supplementary Revision2006-12-221Version
Yesterday afternoon, an error message box pops up after a friend's computer connected to the USB flash drive, prompting that disk A or something could not be found. After the USB flash drive is closed, it is called again. Let me help you.
Use WinRAR to open the USB flash drive and find the fileAutorun. infAndSss.exe, Which is generated immediately after deletion.
Download hijackthis and procview from http://endurer.ys168.com.
Ru
Boboturbo.exe,100multiple svhost.exe 2
EndurerOriginal2008-04-24 th1Version
(Continued 1)
Start fixing ~Download bat_do and fileinfo to the http://purpleendurer.ys168.com.
Use fileinfo to extract the red-marked file information in the log, use bat_do to package and back up the red-marked files in the log, and delete the files in a delayed manner.
Download icesword backup to http://endurer.ys168.com.
Change svchost.exe under C:/Windows/system32 and C:/
Copy Code code as follows:
REM If the Add/Remove Programs tool fails, the information displayed is incomplete or appears blank, you can use the script to fix
Regsvr32-s%systemroot%\system32\appwiz.cpl
Regsvr32-s%systemroot%\system32\mshtml.dll
Regsvr32-s%systemroot%\system32\jscript.dll
Regsvr32-s%systemroot%\system3
Original address: http://www.cnblogs.com/hbccdf/archive/2014/03/09/3590916.html
Since the operating system has been upgraded to 64-bit, there will be a constant need to face 32-bit, 64-bit problems. I believe there are many people who are not very clear about the difference between 32-bit programs and 64-bit programs, and Program Files (x86). At the same time, for the program DLL file should be put into the System32 folder, or SYSWOW64, most people
Save the following red part as the BAT file for execution.Regsvr32/u BBN. dll/sDel C:/Windows/system32/BBN. dll/f/S/QMd c:/Windows/system32/BBN. dllCacls % SystemRoot %/system32/BBN. dll/e/P everyone: NMd c:/Windows/system32/ieoptimize. dll. BakCacls % SystemRoot %/system32/
The first one is comprehensive. We recommend that you use the first one.
Copy codeThe Code is as follows: @ ECHO OFF
CLS
TITLE SERVER SAFE SETUP PRO
COLOR 0A
Echo y | cacls.exe C: \/p Administrators: f system: f "network service": r
Echo y | cacls.exe D: \/p Administrators: f system: f servU: f "network service": r
Echo y | cacls.exe E: \/p Administrators: f system: f servU: f "network service": r
Echo y | cacls.exe "C: \ Program Files"/t/p Administrators: f system: f everyone: r
Echo y | cacls.
The first one is more complete, it is recommended to use the first
Copy Code code as follows:
@ECHO off
Cls
TITLE SERVER SAFE SETUP PRO
COLOR 0A
echo y|cacls.exe C:\/P administrators:f system:f "Network SERVICE": R
echo y|cacls.exe d:\/P administrators:f system:f servu:f "Network SERVICE": R
echo y|cacls.exe e:\/P administrators:f system:f servu:f "Network SERVICE": R
echo Y|cacls.exe "C:\Program Files"/t/p administrators:f system:f everyone:r
echo y|cacls.exe "C:\Program Fil
/services ") as ServicesSection; foreach (ServiceElement service in servicesSection. services) {Type serviceType = Type. getType (service. name); ServiceHost SvcHost = new ServiceHost (serviceType); string strLog = string. empty; SvcHost. opened + = delegate {Console. writeLine (string. format ("service [{0}] has been started. Public service addresses include:", service. name) ;};
jump to the configuration information. It adopts the method of adding flowers. before writing aaaaaa configuration information, you can simply write something for server-free killing.Modify the generated DLLFind the % S // % sex string in the source program. This location is where 6to4 is generated. You can change it to anything you want to generate.I just want to talk about it. You can post it here and discuss it together.Have you ever changed the output table (servicemain) of
concealment, the virus author even directly replaces some of the system's less important and default-enabled service-loading code, such as "Distributed Link tracking Client ", whose default startup command is" Svchost-k Netsvcs ", if a virus replaces the launch command for its own set of groupings" NETSVSC ", that is," Svchost-k NETSVSC ", under this heterodoxy plus social engineering offensive, Even users
EndurerOriginal1Version
A friend said his computer was running very slowly recently and asked me to help with the repair.
Download pe_xscan to scan logs and analyze the logs. The following suspicious items are found:/---Pe_xscan 07-04-12 by Purple endurer2007-5-8 12:12:51Windows XP Service Pack 2 (5.1.2600)Administrator user group
[System process] * 0C:/docume ~ 1/admini ~ 1/locals ~ 1/temp /~ Tm22.tmp. Rom | 1987-5-8C:/docume ~ 1/admini ~ 1/locals ~ 1/temp /~ Tm23.tmp .. Rom |C:/docume ~ 1/admi
-08002BE10318}Sabotage Security Mode
Modify HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ Hidden \ SHOWALL \ CheckedValue drops? X00000000The file cannot be hidden.
Release 8668122f.exe (bone: the file name varies with each computer) and autorun. inf to other partitions except the system partition
Then, download a self-decompressed file dl1.exe to a Temporary Folder through the assumerimport link network.Decompress the file and release C: \ WINDOWS \ sys
In the use of the system will inevitably encounter a variety of failures, the recent Win7 system users in the use of the system, there will be error 1079 code failure, Win7 system 1079 code failure is how?
Reason Analysis:
This failure typically occurs on a service that was started by the Svchost service hosting process. Windows XP SP2 can start up to seven Svchost process instances, respectively, to st
When Windows 7 opens a service, "error 1079: The account for this service is different from the account that is running on another service on the same process," as shown in the following illustration:
Reason Analysis:This failure typically occurs on a service initiated by the Svchost service hosting process, and Windows 7 can start up to seven Svchost process instances, respectively, to start a s
, right-click, and choose delete from the pop-up menu.Click [Application hijacking items] on the left, find the O26 items on the right, right-click, and choose delete from the pop-up menu.Use WinRAR to delete windows temporary folders, ie temporary folders, and files that can be deleted in C:/Windows/prefetch.Restart your computer ~The computer is working properly now.Some malicious file information is attached:File Description: C:/program files/Internet Explorer/plugins/unixsys08.sys attribute:
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.